UniFi Access Application CVE-2026-77546

Exploitation requires network access to the UniFi Access Application and a low-privileged authenticated foothold (PR:L) - a valid low-tier account or access to an authenticated application interface - but no user interaction and only low attack complexity. The concrete prerequisite is the ability to submit input to the application component that is improperly validated (CWE-20) before reaching a host command; the vendor advisory should be consulted for the exact affected feature. Limiting factors: the attacker cannot be fully anonymous (some privilege is needed), the management/application interface must be network-reachable to the attacker, and the deployment must run an unpatched version - so segmenting the interface off untrusted networks materially reduces realistic risk.

This is a genuine high priority rather than an inflated CVSS number. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H combines network reachability, low complexity, no user interaction, and only low privileges with a scope change and total host compromise - an unusually dangerous combination that justifies the 9.9 base score. The one meaningful barrier is PR:L: the attacker must already hold some low-privilege authenticated foothold (a valid account or access to an authenticated interface), which limits fully anonymous internet-wide exploitation and points toward insider, credentialed, or post-phishing abuse. No EPSS score, KEV entry, or POC was provided, so real-world exploitation frequency is currently unquantified; the absence of these signals lowers immediacy but not the underlying criticality, and any operator running UniFi Access with network-exposed management should treat it as urgent given how directly it leads to host takeover.

An attacker who has obtained a low-privileged UniFi Access account or reached an authenticated application endpoint over the network submits crafted input into a field that the application passes to a host command without proper validation. The injected shell metacharacters cause arbitrary commands to run on the host device, and with the scope-changed High CIA impact the attacker can pivot to full control of the appliance. No public POC was provided, so this reflects the vector rather than a confirmed released exploit.